Manalyze report for 419a68880e4bb076f0032eff872eb99d0fc040b2eb7a571f693b3d23375bf9f7

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	1970-Jan-01 00:00:00
Comments
CompanyName
FileDescription
FileVersion	`0.0.0.0`
InternalName	Level9_BlacklistBypass
LegalCopyright
LegalTrademarks
OriginalFilename	Level9_BlacklistBypass.exe
ProductName
ProductVersion

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET` `.NET executable -> Microsoft`
Suspicious	VirusTotal score: 1/70 (Scanned on 2026-10-05 11:12:10)	`McAfeeD: ti!419A68880E4B`

Hashes

MD5	`3c50a1306b700763bf4a9285a4b4ae8c` 🔍
SHA1	`9b06001eba371902d61365a8cf909161fe11b211` 🔍
SHA256	`419a68880e4bb076f0032eff872eb99d0fc040b2eb7a571f693b3d23375bf9f7` 🔍
SHA3	`b06adddcaf7a142dbcd80facba25ef483e008b8ffedb11886c6c7ffb9fe66c40` 🔍
SSDeep	`48:6/19JOfhoa9iIY8TFpUlkAil/vJiUO0Kyw9NsEvEKqDQ9XjFNllczXlAEOOPulC:+LOfhoa9pYM2kt3JiU81jdqO0Lp` 🔍
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	1970-Jan-01 00:00:00
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`8.0`
SizeOfCode	`0xe00`
SizeOfInitializedData	`0x600`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00002C6E (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`4.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`cccffe05a174e4df50e84d8e7307319d 🔍`
SHA1	`d6ca241dfa6a61fc635aadc1bf2394df010b000e 🔍`
SHA256	`dbd10d15b108f054d68b863a7b28bbbe1d2ed57fdec2f7fe9d9a394420adf66d 🔍`
SHA3	`30941a10e18c53037d117d54ebdf35ff35088892337797b080da843d0528948e 🔍`
VirtualSize	`0xc74`
VirtualAddress	`0x2000`
SizeOfRawData	`0xe00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`4.67341`

.rsrc

MD5	`20d05c46327c8e892196edf22c58cc34 🔍`
SHA1	`7390f1462beaa252032a09036738aaea072fcb5f 🔍`
SHA256	`41db009219ccb2f74700ba20384f529db7a5d7f61d6da43a52234811a8846d73 🔍`
SHA3	`da7047f0a22376bf67ec9ec9581cddd3c20287de7eda9bc44bb799ad44b0139d 🔍`
VirtualSize	`0x320`
VirtualAddress	`0x4000`
SizeOfRawData	`0x400`
PointerToRawData	`0x1000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.56017`

.reloc

MD5	`7802b571c0fb5b6336a3e44b5fa279a8 🔍`
SHA1	`ec704411bbc069967901bd280622460beb91bafa 🔍`
SHA256	`af38074fbf22b6a83f97ea94a28fb5e9217d255b0985dcabd81804c894bd0765 🔍`
SHA3	`51ab287ebb98ac35b0be51f588fbe41283896821dec631957c3996c47da162ff 🔍`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x2c8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.24189`
MD5	`4c3c8f3842c9f0a0be5ee0e006926321 🔍`
SHA1	`7c4fbc0da5d49fbd0e77ff79f094ee31b8685ae7 🔍`
SHA256	`bc69198db052a708d9db3fa0266bd81c5143b6525b405cc8a10fa7a977c8573a 🔍`
SHA3	`98d7b22a7cd9d4a71ef62a002c12c9f91d3738912d003a00e6feec7ab69a3c87 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_DLL`
Language	UNKNOWN
Comments
CompanyName
FileDescription
FileVersion (#2)	0.0.0.0
InternalName	Level9_BlacklistBypass
LegalCopyright
LegalTrademarks
OriginalFilename	Level9_BlacklistBypass.exe
ProductName
ProductVersion (#2)

Resource LangID	UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.